ThreatCluster aggregates cybersecurity news from 4000+ sources and clusters related articles together automatically. Instead of reading 10 articles about the same incident, you get one cluster with the full picture. Every cluster includes extracted IOCs, MITRE ATT&CK mappings, threat scoring, and entity tracking for malware, APT groups, CVEs, and more. Free to use. No signup required. Also available as an RSS feed and native MISP feed for direct import into your threat intel platform.

I built ThreatCluster because I was tired of drowning in duplicate threat intel. Every major vulnerability gets covered by dozens of outlets, and keeping up meant reading the same story 15 different ways. The idea was simple: what if related articles were automatically grouped together? One cluster per threat, not ten separate tabs. It started as a side project scraping a handful of RSS feeds. Now it processes 500+ articles daily from 4000+ sources, extracts IOCs and entities using a mix of regex and fine-tuned models, and clusters everything using embeddings and density-based algorithms. Delivers daily intel to 1000+ security professionals at organisations including KPMG, SHEIN, NCR Atleos, and TRUMPF. It's free and always will be. Would love to hear what features the community wants next.

ThreatCluster

Cyber Threat Intelligence without the noise

Cyber Threat Intelligence without the noise